26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T443,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample baf21b20ed39… — Score 45/100 — Hybrid Analysis","description":"Suspicious verdict for sample baf21b20ed39…. Threat score 45/100. 0/27 AV engines flagged this file. 1 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea"],"about":{"@type":"SoftwareApplication","name":"Keyboard iOS 15 v1.1.6 Premium Mod Apk {CracksHash}.apk","applicationCategory":["android"],"identifier":"baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea","additionalType":"Suspicious sample"},"threatScore":45,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tc08,"firebase-measurement-connector.properties+K-*" (Indicator: "connect") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "org/joda/time/tz/data/Europe/Copenhagensf`a`" (Indicator: "open") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/animator/fragment_open_enter.xml" (Indicator: "open") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/animator/fragment_open_exit.xml" (Indicator: "open") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/color/abc_background_cache_hint_selector_material_dark.xmluP" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/color/abc_background_cache_hint_selector_material_light.xmluP" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/color/mtrl_btn_bg_color_selector.xml" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/color/mtrl_btn_stroke_color_selector.xmluP1N" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/color/mtrl_btn_text_btn_bg_color_selector.xmluP" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/color/mtrl_btn_text_color_selector.xml" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/color/mtrl_calendar_selected_range.xmlcf" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/color/mtrl_fab_bg_color_selector.xml" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/color/mtrl_fab_icon_text_color_selector.xml" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/color/mtrl_on_primary_text_btn_text_color_selector.xmluP" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/color/mtrl_tabs_icon_color_selector.xml" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/color/mtrl_tabs_icon_color_selector_colored.xmlcf" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/color/mtrl_tabs_legacy_text_color_selector.xmluP" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/color/mtrl_text_btn_text_color_selector.xml" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/color/test_mtrl_calendar_day_selected.xmluOA" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "res/drawable-hdpi-v4/abc_list_selector_disabled_holo_dark.9.png" (Indicator: "select") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk28:T4de,Found invoke in "u6.c.smali" to "android.net.NetworkInfo.isConnected" Found invoke in "u6.c.smali" to "android.net.ConnectivityManager.getAllNetworkInfo" Found invoke in "r6.d.smali" to "android.net.ConnectivityManager.getAllNetworkInfo" Found invoke in "r6.d.smali" to "android.net.NetworkInfo.isConnected" Found invoke in "x2.d.smali" to "android.net.ConnectivityManager.getActiveNetworkInfo" Found invoke in "x2.d.smali" to "android.net.NetworkInfo.isConnected" Found invoke in "com.unity3d.services.core.connectivity.ConnectivityChangeReceiver.smali" to "android.net.NetworkInfo.isConnected" Found invoke in "com.unity3d.services.core.connectivity.ConnectivityChangeReceiver.smali" to "android.net.ConnectivityManager.getActiveNetworkInfo" Found invoke in "com.unity3d.services.core.connectivity.ConnectivityMonitor.smali" to "android.net.NetworkInfo.isConnected" Found invoke in "com.unity3d.services.core.connectivity.ConnectivityMonitor.smali" to "android.net.ConnectivityManager.getActiveNetworkInfo" Found invoke in "com.unity3d.services.core.device.Device.smali" to "android.net.ConnectivityManager.getActiveNetworkInfo" Found invoke in "com.unity3d.services.core.device.Device.smali" to "android.net.NetworkInfo.isConnected"29:T1293,Pattern match: "https://simplemobiletools.com" Pattern match: "https://play.google.com/store/apps/details?id=com.simplemobiletools.thankyou" Pattern match: "https://github.com/SimpleMobileTools/General-Discussion#how-can-i-suggest-an-edit-to-a-file" Heuristic match: "HH843299977056-obkmklt3d9dcv50qkm8u02sohn8b46uk.apps.googleusercontent.com" Pattern match: "https://www.apache.org/licenses/LICENSE-2.0" Pattern match: "http://www.apache.org/licenses/LICENSE-2.0" Pattern match: "https://play.google.com/store/apps/details?id=com.simplemobiletools.xxx.pro" Heuristic match: "hello@simplemobiletools.com" Pattern match: "developer.android.com/training/testing/espresso/index.html" Pattern match: "https://github.com/Armen101/AudioRecordView" Pattern match: "github.com/ArthurHub/Android-Image-Cropper" Pattern match: "https://github.com/JetBrains/kotlin" Pattern match: "https://github.com/JodaOrg/joda-time" Pattern match: "https://github.com/ShawnLin013/NumberPicker" Pattern match: "https://github.com/ajalt/reprint" Pattern match: "https://github.com/alexvasilkov/GestureViews" Pattern match: "https://github.com/aritraroy/PatternLockView" Pattern match: "https://github.com/bumptech/glide" Pattern match: "https://github.com/chrisbanes/PhotoView" Pattern match: "https://github.com/davemorrissey/subsampling-scale-image-view" Pattern match: "https://github.com/duolingo/rtl-viewpager" Pattern match: "https://github.com/facebook/stetho" Pattern match: "https://github.com/google/ExoPlayer" Pattern match: "https://github.com/google/gson" Pattern match: "https://github.com/googlevr/gvr-android-sdk" Pattern match: "github.com/grantland/android-autofittextview" Pattern match: "https://github.com/greenrobot/EventBus" Pattern match: "https://github.com/klinker41/android-smsmms" Pattern match: "https://github.com/koral--/android-gif-drawable" Pattern match: "https://github.com/penfeizhou/APNG4Android" Pattern match: "https://github.com/ravi8x/AndroidPhotoFilters" Pattern match: "https://github.com/reddit/IndicatorFastScroll" Pattern match: "https://github.com/robolectric/robolectric" Pattern match: "https://github.com/square/leakcanary" Pattern match: "https://github.com/square/otto" Pattern match: "https://github.com/square/picasso" Pattern match: "https://github.com/vinc3m1" Pattern match: "https://github.com/vinc3m1/RoundedImageView" Pattern match: "https://github.com/vinc3m1/RoundedImageView.git" Pattern match: "mvnrepository.com/artifact/org.apache.sanselan/sanselan/0.97-incubator" Pattern match: "play.google.com/store/apps/details?id=com.simplemobiletools.thankyou" Pattern match: "https://simplemobiletools.com/donate" Heuristic match: "ikeyboard-c1026.appspot.com" Heuristic match: "crashlytics.installation.id" Heuristic match: "firebase.installation.id" Heuristic match: "kotlin.Int" Heuristic match: "vunhiem96@gmail.com" Heuristic match: "Please send mail to vunhiem96@gmail.com" Pattern match: "https://update.crashlytics.com/spi/v1/platforms/android/apps" Pattern match: "https://update.crashlytics.com/spi/v1/platforms/android/apps/%s" Pattern match: "https://reports.crashlytics.com/spi/v1/platforms/android/apps/%s/reports" Pattern match: "https://reports.crashlytics.com/sdk-api/v1/platforms/android/apps/%s/minidumps" Heuristic match: "app-measurement.com" Pattern match: "https://app-measurement.com/a" Pattern match: "https://goo.gl/J1sWQy" Pattern match: "http://play.google.com/store/apps/details?id=com.nhstudio.thankyou.flashios" Pattern match: "unityads.unity3d.com/webview/" Pattern match: "unityads.unitychina.cn/webview/" Heuristic match: "google.to" Heuristic match: "google.c.sender.id" Pattern match: "http://schemas.android.com/apk/res/android" Pattern match: "http://schemas.android.com/apk/res-auto" Pattern match: "https://goo.gl/NAOOOI" Pattern match: "https://firebase.google.com/support/guides/disable-analytics" Pattern match: "DiskCacheStrategy.DATA/DiskCacheStrategy.NONE" Pattern match: "https://www.facebook.com/adnw_logging/" Pattern match: "http://play.google.com/store/apps/details?id=" Heuristic match: "Name: META-INF/androidx.localbroadcastmanager_localbroadcastmanager.ve" Heuristic match: "Name: res/drawable-hdpi-v4/abc_scrubber_control_to_pressed_mtrl_000.pn" Heuristic match: "Name: res/drawable-hdpi-v4/abc_scrubber_control_to_pressed_mtrl_005.pn" Heuristic match: "Name: res/drawable-mdpi-v4/abc_scrubber_control_to_pressed_mtrl_000.pn" Heuristic match: "Name: res/drawable-mdpi-v4/abc_scrubber_control_to_pressed_mtrl_005.pn" Heuristic match: "Name: res/drawable-xhdpi-v4/abc_list_selector_disabled_holo_light.9.pn" Heuristic match: "Name: res/drawable-xxhdpi-v4/abc_list_selector_disabled_holo_dark.9.pn"2a:T8fb,"https://simplemobiletools.com" (Indicator: "https://") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk ". Hello,

hope you are enjoying the app. It contains no ads, please support its development by purchasing the Simple Thank You app, it will also prevent this dialog from showing up again.

Thank you!" (Indicator: "https://") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "Please purchase Simple Thank You to unlock this function and support the development. Thanks!" (Indicator: "https://") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "The widget is locked.
Please purchase Simple Thank You to unlock it." (Indicator: "https://") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "This list contains everyone that noticeably helped any app within the Simple Mobile Tools suite, not only this one. Translations are handled by volunteers, let us know if you want to help too. The guide to translating is at this website, or just contact us at hello@simplemobiletools.com if you have any questions. Thanks to all contributors and other supporters!" (Indicator: "https://") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk "Yes, of course. You can spread the word about the apps or give good feedback and ratings. You can also help by translating the apps in a new language, or just update some existing translations. The guide to translating is at this website, or just contact us at hello@simplemobiletools.com if you have any questions." (Indicator: "https://") in Source: baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea.apk2b:T41d,Found invoke in "h0.f.smali" to "java.lang.reflect.Method.invoke" Found invoke in "h0.f.smali" to "java.lang.reflect.Field.get" Found invoke in "h0.t.smali" to "java.lang.reflect.Method.invoke" Found invoke in "h0.y$a.smali" to "java.lang.reflect.Field.get" Found invoke in "h0.q.smali" to "java.lang.reflect.Field.get" Found invoke in "h0.y$e.smali" to "java.lang.reflect.Method.invoke" Found invoke in "h0.y$e.smali" to "java.lang.reflect.Field.get" Found invoke in "a8.a.smali" to "java.lang.reflect.Method.invoke" Found invoke in "e.n$a.smali" to "java.lang.reflect.Method.invoke" Found invoke in "e.o.smali" to "java.lang.reflect.Field.get" Found invoke in "e.h.smali" to "java.lang.reflect.Method.invoke" Found invoke in "e.h.smali" to "java.lang.reflect.Field.get" Found invoke in "u6.b.smali" to "java.lang.reflect.Method.invoke" Found invoke in "s3.z5.smali" to "java.lang.reflect.Method.invoke" Found invoke in "s3.d5.smali" to "java.lang.reflect.Method.invoke" Found invoke in "s3.i5.smali" to "java.lang.reflect.Method.invoke"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":45,"unified_at_epoch_ms":1791470407169,"unified_at":"2026-10-08T14:40:07.169Z","metadata":{"hashes":{"sha256":"baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea","sha1":"71d538adbc8e30f868c7629b0d3edd317b8c1cda","md5":"1968774b670bb684cad97b26dce02ff9","sha512":"3b6e69be8cc7719001ca886e7d11b524f46606339aa82e59fbdb9dab58d07fc9bdf1ade75577bde21b51772506fc9408f682202b4c9e01086b5ea071a5f3f2e0","ssdeep":"98304:FchY7R07M7Y4LVNzPbDl65HQbOEfr+qaGqf3E:FT7C7M7YiVNzbD1iGaU","ssdeep_chunks":["98304:FchY7R0","98304:chY7R07","98304:hY7R07M","98304:Y7R07M7","98304:7R07M7Y","98304:R07M7Y4","98304:07M7Y4L","98304:7M7Y4LV","98304:M7Y4LVN","98304:7Y4LVNz","98304:Y4LVNzP","98304:4LVNzPb","98304:LVNzPbD","98304:VNzPbDl","98304:NzPbDl6","98304:zPbDl65","98304:PbDl65H","98304:bDl65HQ","98304:Dl65HQb","98304:l65HQbO","98304:65HQbOE","98304:5HQbOEf","98304:HQbOEfr","98304:QbOEfr+","98304:bOEfr+q","98304:OEfr+qa","98304:Efr+qaG","98304:fr+qaGq","98304:r+qaGqf","98304:+qaGqf3","98304:qaGqf3E","196608:FchY7R0","196608:chY7R07","196608:hY7R07M","196608:Y7R07M7","196608:7R07M7Y","196608:R07M7Y4","196608:07M7Y4L","196608:7M7Y4LV","196608:M7Y4LVN","196608:7Y4LVNz","196608:Y4LVNzP","196608:4LVNzPb","196608:LVNzPbD","196608:VNzPbDl","196608:NzPbDl6","196608:zPbDl65","196608:PbDl65H","196608:bDl65HQ","196608:Dl65HQb","196608:l65HQbO","196608:65HQbOE","196608:5HQbOEf","196608:HQbOEfr","196608:QbOEfr+","196608:bOEfr+q","196608:OEfr+qa","196608:Efr+qaG","196608:fr+qaGq","196608:r+qaGqf","196608:+qaGqf3","196608:qaGqf3E","98304:FT7C7M7","98304:T7C7M7Y","98304:7C7M7Yi","98304:C7M7YiV","98304:7M7YiVN","98304:M7YiVNz","98304:7YiVNzb","98304:YiVNzbD","98304:iVNzbD1","98304:VNzbD1i","98304:NzbD1iG","98304:zbD1iGa","98304:bD1iGaU"],"imphash":"Unknown"},"file_info":{"file_name":"Keyboard iOS 15 v1.1.6 Premium Mod Apk {CracksHash}.apk","file_type":["android"],"file_type_id":"apk","file_size":6806017,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1653319832000,"last_seen":1679059655000,"last_multi_scan":1679059655000}},"detections":{"summary":{"verdict":"suspicious","score":45,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":10},"sandbox_signatures":{"informative_count":8,"suspicious_count":5,"malicious_count":1,"total":14},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Persistence","technique":"Code Injection","attack_id":"T1540","attack_id_wiki":"https://attack.mitre.org/techniques/T1540","identifiers":[{"type":"malicious","value":"Has the ability to use the DexClassLoader (possible code injection)"}],"sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"tactic":"Defense Evasion","technique":"Application Discovery","attack_id":"T1418","attack_id_wiki":"https://attack.mitre.org/techniques/T1418","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"tactic":"Credential Access","technique":"Access Stored Application Data","attack_id":"T1409","attack_id_wiki":"https://attack.mitre.org/techniques/T1409","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1420","attack_id_wiki":"https://attack.mitre.org/techniques/T1420","identifiers":[{"type":"suspicious","value":"Has the ability to access external storage"}],"sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"tactic":"Discovery","technique":"Location Tracking","attack_id":"T1430","attack_id_wiki":"https://attack.mitre.org/techniques/T1430","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1421","attack_id_wiki":"https://attack.mitre.org/techniques/T1421","identifiers":[{"type":"informative","value":"Tests the internet connectivity"}],"sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"tactic":"Impact","technique":"Carrier Billing Fraud","attack_id":"T1448","attack_id_wiki":"https://attack.mitre.org/techniques/T1448","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]}],"sandbox_signatures":[{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/62 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DebugProbesKt.bin\" as clean (type is \"compiled Java class data version 50.0 (Java 1.6)\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$27","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"level":"informative","category":"General","name":"Requires permissions only available to signed APKs","description":"Found permission request for \"android.permission.BIND_INPUT_METHOD\"","origin":"Static Parser","relevance":7,"id":"static-29","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"level":"informative","category":"General","name":"Tests the internet connectivity","description":"$28","origin":"Static Parser","mitre_attack_id":"T1421","relevance":3,"id":"static-41","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"https://www.facebook.com/adnw_logging/\" (Indicator: \"facebook.com\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"\"org/joda/time/tz/data/America/Kentucky/Monticello%\" (Indicator: \"ntice\")\n \"Name: org/joda/time/tz/data/America/Kentucky/Monticello\" (Indicator: \"ntice\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"hello@simplemobiletools.com\"\n Pattern match: \"vunhiem96@gmail.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"level":"suspicious","category":"General","name":"Uses java reflection classes","description":"$2b","origin":"Static Parser","relevance":3,"id":"static-47","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Has the ability to access external storage","description":"Found invoke in \"u6.b.smali\" to \"android.os.Environment.getExternalStorageDirectory\"\n Found invoke in \"com.unity3d.services.core.cache.CacheDirectory.smali\" to \"android.os.Environment.getExternalStorageState\"","origin":"Static Parser","mitre_attack_id":"T1420","relevance":3,"id":"static-45","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"level":"suspicious","category":"Network Related","name":"Has the ability to open an internet connection","description":"Found invoke in \"com.unity3d.services.core.request.WebRequest.smali\" to \"java.net.URL.openConnection\"\n Found invoke in \"com.bumptech.glide.load.data.j.smali\" to \"java.net.URL.openConnection\"\n Found invoke in \"com.facebook.ads.internal.dynamicloading.DexLoadErrorReporter$a.smali\" to \"java.net.URL.openConnection\"","origin":"Static Parser","relevance":3,"id":"static-46","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Has the ability to use the DexClassLoader (possible code injection)","description":"Found invoke in \"com.facebook.ads.internal.dynamicloading.DynamicLoaderFactory.smali\" to \"dalvik.system.DexClassLoader.\"","origin":"Static Parser","mitre_attack_id":"T1540","relevance":3,"id":"static-54","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]}]},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"628ba8965b72944084069b5a","environment_id":200,"environment_description":"Android Static Analysis","state":"SUCCESS","verdict":"suspicious","threat_score":45,"submit_name":"Keyboard iOS 15 v1.1.6 Premium Mod Apk {CracksHash}.apk","analysis_start_time":"2022-05-23T15:30:34+00:00","indicators_count":{"informative":8,"suspicious":11,"malicious":1},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DebugProbesKt.bin","sha256":"ab6d48d5d868c733cd03345f8aabae3d905bd6f0fc661117a8bdfea6c51b9274","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"AndroidManifest.xml","sha256":"15c8af22d18b3ca8df6b9a519f3784f38ed941396daba070d2a76d1a4f374ec5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"CERT.RSA","sha256":"fa82131b77b429dab1fc79064bcb06b4a9011833a6650e5bd4e24ce9c0873bbf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"CERT.SF","sha256":"b9b152dc59bf2b99d3bcf6aa30de383e76f86e4b65d8c0b53d06aa00403e527f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"MANIFEST.MF","sha256":"4cb7c77607739fca59f67d0e0283512b8c40b936a325efe7404afa5d5783af6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"androidx.activity_activity-ktx.version","sha256":"1575e1af4a95f12f70b4ee6a6adce8160953d93ea17dc2611b90883ccc3ad3b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"androidx.activity_activity.version","sha256":"563a0b4eec3c77bbc34ac630d4fa5214f5c6726ae01468404fd704473110084e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"androidx.annotation_annotation-experimental.version","sha256":"1575e1af4a95f12f70b4ee6a6adce8160953d93ea17dc2611b90883ccc3ad3b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"androidx.appcompat_appcompat-resources.version","sha256":"10e2e117b01523891ca271a615ae36e9d5e52348fd7d642f66727602c1b8dcbe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"androidx.appcompat_appcompat.version","sha256":"10e2e117b01523891ca271a615ae36e9d5e52348fd7d642f66727602c1b8dcbe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"androidx.arch.core_core-runtime.version","sha256":"c89b87c262e9d5ffd20e73aac74a1772adcc9f5a21682cc33adcf5086e5fef5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"androidx.asynclayoutinflater_asynclayoutinflater.version","sha256":"59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"androidx.biometric_biometric-ktx.version","sha256":"f294bacdf8ca148ebeb214372926b01314e945e116f39e09d61e3bb4dae7e3c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"androidx.biometric_biometric.version","sha256":"f294bacdf8ca148ebeb214372926b01314e945e116f39e09d61e3bb4dae7e3c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"androidx.cardview_cardview.version","sha256":"59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"androidx.coordinatorlayout_coordinatorlayout.version","sha256":"1575e1af4a95f12f70b4ee6a6adce8160953d93ea17dc2611b90883ccc3ad3b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"androidx.core_core-ktx.version","sha256":"cb1d9a30bc4ab8a397f39b7d786bb82aca0b816077eefc35d7c822017d75f6a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"androidx.core_core.version","sha256":"cb1d9a30bc4ab8a397f39b7d786bb82aca0b816077eefc35d7c822017d75f6a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"androidx.cursoradapter_cursoradapter.version","sha256":"59854984853104df5c353e2f681a15fc7924742f9a2e468c29af248dce45ce03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]},{"name":"androidx.customview_customview.version","sha256":"1575e1af4a95f12f70b4ee6a6adce8160953d93ea17dc2611b90883ccc3ad3b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"628ba8965b72944084069b5a"}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["628ba8965b72944084069b5a"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Suspicious Sample baf21b20ed39… — Score 45/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample baf21b20ed39…. Threat score 45/100. 0/27 AV engines flagged this file. 1 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample baf21b20ed39… — Score 45/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample baf21b20ed39…. Threat score 45/100. 0/27 AV engines flagged this file. 1 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/baf21b20ed3928474f7b81ed9753598da4f19ff315613ce6f061995ce0f655ea"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample baf21b20ed39… — Score 45/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample baf21b20ed39…. Threat score 45/100. 0/27 AV engines flagged this file. 1 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]